# HG changeset patch
# User Benoit Boissinot <benoit.boissinot@ens-lyon.org>
# Date 2009-03-06 23:59:41
# Node ID b5ed0ab8cc74b25124aaec358366e1e7aaec8057
# Parent  6542be5df71969ab4b2942539bfb86d3cca07f17

hgweb: fix allow_read permissions when a user is specified

Thanks to Juan Pablo Aroztegi for reporting and debugging it.

diff --git a/mercurial/hgweb/hgweb_mod.py b/mercurial/hgweb/hgweb_mod.py
--- a/mercurial/hgweb/hgweb_mod.py
+++ b/mercurial/hgweb/hgweb_mod.py
@@ -284,7 +284,7 @@ class hgweb(object):
 
         allow_read = self.configlist('web', 'allow_read')
         result = (not allow_read) or (allow_read == ['*'])
-        if not result or user in allow_read:
+        if not (result or user in allow_read):
             raise ErrorResponse(HTTP_UNAUTHORIZED, 'read not authorized')
 
         if op == 'pull' and not self.allowpull: